Unauthorized Access to Japan's Government Solution Service (GSS) Exposes 246,000 Personal Records via VPN Flaw
Japan's Digital Agency has disclosed that its Government Solution Service (GSS) was compromised through unauthorized access that exploited a vulnerability in VPN equipment used for remote maintenance.
Attackers gained entry by targeting the VPN device employed for external support operations, leading to the compromise of maintenance accounts. Evidence indicates the intrusion began around late May 2026.
On June 25, 2026, monitoring systems detected unusual activity when a compromised account accessed a large number of files stored on GSS servers. Subsequent investigation with external partners confirmed the breach on July 9.
Some files may have been exfiltrated, potentially exposing 246,000 personal records. These include approximately 189,000 entries related to staff from related agencies and civil servants, plus 57,000 records concerning businesses and individuals involved in associated operations. The data encompasses names, email addresses, telephone numbers, and residential addresses collected during official duties.
The agency responded on July 9 by disabling the compromised accounts and blocking all external communications. Specific details about the VPN vulnerability remain undisclosed.
Related articles
Notion Confirms Exposure of AI Assistant Transcripts After Fireworks AI Breach
Notion has confirmed that a security incident at Fireworks AI exposed conversation transcripts from its Notion AI assistant, affecting less than 1% of customer workspaces. The breach occurred because Fireworks handled classification tasks for the Insights feature and served open-weight models. Notion stated that its own systems were not compromised. The timeline shows initial notification on November 2, 2026, followed by disconnection of systems on November 3 and confirmation of customer data exposure on November 8. Most transcripts lacked author or workspace attribution and did not include tool call results, though user-entered content could still identify individuals or organizations. Fireworks attributed the intrusion to a financially motivated group engaged in LLMjacking, involving theft of credentials to hijack AI models for illicit use.
Beget Outlines Four-Stage Recovery of Servers After Cyberattack Destroys Cloud Infrastructure
Russian hosting provider Beget has provided an update on restoring its infrastructure following a destructive cyberattack that occurred on the night of November 2, 2026. Attackers gained access to the management contour and executed wiping scripts, resulting in total data loss across VPS, S3, and Kubernetes environments while file-level backups of VPS remained intact. The company is now recovering dozens of virtual hosting servers from backups in parallel using multiple data streams. Each affected server undergoes a structured four-stage restoration process that includes OS installation, environment setup, data loading, and gradual reactivation of thousands of customer sites. Beget has already brought more than 18,000 websites back online, with 66 servers currently in the recovery pipeline. The Coordination Center for .RU and .RF domains has temporarily suspended Beget’s registrar accreditation, preventing new registrations during the suspension period.
Beget Loses Accreditation as .RU and .РФ Domain Registrar After Cyberattack
Following a cyberattack on November 2, Russian domain registrar and hosting provider Beget has had its accreditation temporarily suspended by the Coordination Center for .RU and .РФ domains. The company can no longer register new domains in the .RU, .РФ, and .SU zones or accept transfers from other registrars. Beget must continue supporting all domains registered before the suspension, and expiration dates have been postponed by agreement with the Coordination Center and RosNIIROS to prevent any loss of domains. The incident stems from attackers gaining access to the management infrastructure and deploying wiping scripts. Partial functionality has been restored in the control panel, but full domain management features for the affected zones will return only after accreditation is reinstated. No specific recovery timeline has been announced.
Beget Rebuilds Cloud Infrastructure After Destructive Cyberattack Wipes VPS Backups
Beget suffered a severe cyberattack that allowed threat actors to access the management layer of its entire cloud architecture and execute wiping scripts. The incident destroyed cloud infrastructure and left backup copies of VPS files available to only half of the affected users. Internal systems were also hit, breaking links between customer accounts and services, forcing the provider to reconstruct ownership records. Hosting services have recovered more than 60 percent, while full cloud restoration timelines remain unknown. The attack disrupted BelkaCar’s car-sharing application, which relied on Beget for backend connectivity and has since migrated to another provider.